A 12-year employee of UMass Memorial Medical Center who was the subject of several internal investigations for improper access to patient records was finally placed on paid leave in 2014 after being caught opening a credit card in the name of a deceased patient. The patient’s widow complained to the physician, but it was allegedly not passed on for more than six months, allowing the employee time to try and start more fraudulent accounts, including for cell phone service.
Also in 2014, a person hired six years earlier by a UMass Memorial affiliated physicians group used a billing coworker’s credentials to steal patient information, which was then offered to someone “as payment for a debt.” Other documents containing protected health information (PHI) that the employee apparently pilfered were later discovered in a backpack in the possession of law enforcement as part of an unrelated investigation.
The two employees, who ultimately resigned, potentially breached the PHI of 15,000 individuals, Massachusetts Attorney General (AG) Maura Healey said Sept. 20. UMass Memorial Medical Center and UMass Medical Group will pay $230,000 to resolve the AG’s allegations and implement extensive corrective actions, including hiring an external monitor.
The settlement is a reminder that state attorneys generally will use the authority granted them by the HITECH Act to pursue enforcement of HIPAA and state laws. In a complaint filed in Suffolk County Superior Court on Sept. 13, Healey alleged “UMass Memorial Medical Center Inc. knew of these employees’ misconduct but failed to properly investigate complaints related to these breaches, discipline the employees involved in a timely manner, or take other steps to safeguard the information.” She also accused UMass Memorial of having “inadequate data security policies” and of not properly training and disciplining employees, in violation of HIPAA and of two commonwealth laws—the Consumer Protection Act and the Massachusetts Data Security Law. UMass Memorial did not admit wrongdoing but in a statement said it “regrets that these incidents occurred” and that it has beefed up its privacy and security efforts.
